2724041c1169286f8e7b1e9a4370391e[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2724041c1169286f8e7b1e9a4370391e.bin
Size

63KB
MD5

2724041c1169286f8e7b1e9a4370391e
SHA1

78e2b834062203d3e5d35e9e492076699efb9ef4
SHA256

b27571a124fef63ce3c4ace6f8bc9f9b9305e648da624b99d445ad1c2415d651
SHA512

16bee5358499e5466756243c4e0a5fc56669ef230c5cb08787de12265888add043b2e206f69eeb575d2c5e34c6e95661fd5cbdeae7130a655eeb3caef67016fe
SSDEEP

1536:w6+/Q3nCSd8h2V5sLps2HXGoq8TPNjK4U:w6cU58hTq8X75nU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2724041c1169286f8e7b1e9a4370391e.bin

Files

2724041c1169286f8e7b1e9a4370391e.bin
.exe windows:4 windows x86 arch:x86

b3be174bd0cf56dacb310b328dcfb3b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
ReleaseMutex
lstrcatA
HeapReAlloc
CreateEventW
VirtualAlloc
GetModuleHandleA
CreateThread
WideCharToMultiByte
Sleep
lstrcmpiA
FindFirstFileW
WaitForSingleObject
ExpandEnvironmentStringsW
GetFileAttributesA
lstrcatW

advapi32

CryptGetHashParam
RegEnumKeyExA
CryptAcquireContextW
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
GetUserNameW
DuplicateTokenEx

shlwapi

PathCombineW
PathRemoveFileSpecW
PathMatchSpecW
PathFindFileNameW
SHDeleteKeyA
wvnsprintfA
StrCmpNIW
PathFileExistsW
wvnsprintfW
StrStrW
wnsprintfW
wnsprintfA
StrCmpNIA

user32

MsgWaitForMultipleObjects
CloseWindowStation
ExitWindowsEx
GetWindowThreadProcessId
SetThreadDesktop
FindWindowExA
GetCursorPos
GetForegroundWindow
CharLowerBuffA
GetClipboardData
SendMessageA

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE